The certificate/chain needs to be imported into GAD/GAS's default trusted certificate store. When specifying the LDAP/Active Directory URL, type the URL using "ldaps://" instead of "ldap://" if secure connection is desired. A restart may be required after importing the certificates.